A deployed Claude API integration begins receiving unusual requests. Analysis reveals a pattern: requests start with benign context-setting, then gradually escalate through several turns to requests that violate content policies. Each individual turn appears borderline acceptable, but the cumulative trajectory clearly aims to elicit policy-violating content. What defense architecture addresses this multi-turn escalation pattern?

B is correct because multi-turn escalation attacks exploit the gap between per-turn safety evaluation and conversation-level intent — each individual turn may pass per-turn filters while the sequence reveals a clear policy-circumvention intent. Conversation-level risk scoring that accumulates across turns can detect escalation patterns (repeated boundary testing, gradual persona manipulation) and intervene before the target request is reached. A is wrong because applying filtering only to the final turn is exactly the vulnerability being exploited — the attack works precisely because each early turn appears benign; analyzing only the final turn misses the manipulative trajectory. C is wrong because blocking all multi-turn conversations eliminates the conversational capability that makes Claude useful for complex tasks — legitimate multi-turn use cases (debugging, iterative writing, complex analysis) would be destroyed. D is wrong because stricter per-turn thresholds increase false positives on legitimate borderline requests without addressing the escalation trajectory problem — the attack uses individually borderline turns precisely because they pass per-turn thresholds.